5c39c76304b801bc9182077cc8fa1929b6c9c8e8c885eb338cdf9f48ea9b27f3

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2023, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4204-271-0x0000000000590000-0x00000000005C0000-memory.exe
Size

192KB
MD5

c5b329d21da87230b8f923e81bf0c253
SHA1

2f88646d36ecdd3b20ef073fa9904756ca44d442
SHA256

5c39c76304b801bc9182077cc8fa1929b6c9c8e8c885eb338cdf9f48ea9b27f3
SHA512

49883c66cc6ab376a2431a7bf698ecb80c3f5a56192b4b7e5d2af5e9520a978891813fa62ced97d0a1b84a89a1c4de85de9fca721fc800249b349c6e6762edf5
SSDEEP

1536:lhbEey6y36sv0W7TDGOIrHuyk7xk2W5/uGxNFVYQffbuclGHQ4N0GkRE8e8h3:llEebE6Cyk9i5/uGxNMS3azNX8e8h3

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2d52361f-5682-45b7-bd95-278cfe4006af.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230702080853.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
1092	msedge.exe
1092	msedge.exe
5048	identity_helper.exe
5048	identity_helper.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 1092	4252	4204-271-0x0000000000590000-0x00000000005C0000-memory.exe	92
PID 4252 wrote to memory of 1092	4252	4204-271-0x0000000000590000-0x00000000005C0000-memory.exe	92
PID 1092 wrote to memory of 2472	1092	msedge.exe	93
PID 1092 wrote to memory of 2472	1092	msedge.exe	93
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4612	1092	msedge.exe	94
PID 1092 wrote to memory of 4584	1092	msedge.exe	95
PID 1092 wrote to memory of 4584	1092	msedge.exe	95
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97
PID 1092 wrote to memory of 2296	1092	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\4204-271-0x0000000000590000-0x00000000005C0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4204-271-0x0000000000590000-0x00000000005C0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4204-271-0x0000000000590000-0x00000000005C0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x80,0x104,0x7ff8217346f8,0x7ff821734708,0x7ff821734718
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6f8b55460,0x7ff6f8b55470,0x7ff6f8b55480
      4⤵
      PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5444500903847578682,9651024548923067902,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4204-271-0x0000000000590000-0x00000000005C0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8217346f8,0x7ff821734708,0x7ff821734718
    3⤵
    PID:2708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb62f344ad026c624f757eeb452e2ee2

SHA1
69d135731ecd414f7f7b1ed5a6d4a6e4414dce92

SHA256
61cf4c2a79753705e6ecd28867b548115e83cbdb76a5a124849cd094635d2d6a

SHA512
50318f97a2fae97f9483d1eb87b4cb8ec3f22f22f21749f375ee3210ad8ad1c3929f8afc60fcaf19d5fc2c4a8420fb0da5787744c589b25f70ff763c6abfcb6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b72766c66a875151e79dfeededb697e8

SHA1
0f8f119b9dcce22ace21bb9687b608a3656b85e9

SHA256
9be61a806e4ced73e82d360253e02c1980e3e1a098e4bb4a6c16dfcca797e1f2

SHA512
2a62370c518c5b423461c7641326bb60ace892ec549aa1f45ca3e7d1ee52436920cbd72aeef7923ffe02cfe9a29c9f531dd45ba80a73b2c6950edbac99689faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
69ec9d65860096e102d088dd0a61d4fd

SHA1
39beb1bc1c1821ce283f6e6d3e8667f0c6274c17

SHA256
4edd5e53ec03636a9ebd110643886f6b93e584079f78cedb7b47e0af81ed566b

SHA512
76ef106710ec83fa19d847f1003e6c70ea5bce258982aecf07d3da773dbe4a394127f278bee773b4b14d454d17a045ec13603fec6a1cdaa1cd8f7deb072887dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe570be7.TMP

Filesize
48B

MD5
e58704831cd3c5d103d73c5b50b06aef

SHA1
52aec538b24ce27317c6935ad441041f7df29b52

SHA256
3aa2027db160abcc432b1163035b5b7a4f804173aaf46bd44a6971bdf5aeb99d

SHA512
8049ce1bf7fa2188fd7ab7523667e565d03cecf7ceb95ae3cc9094e8f2883013997fac21b168c4d6b642160ae245f17cc73e45783fefe05156af2c70ea1c325f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
0a559a809af1170631d9d131e26ca2c7

SHA1
e68390e5ee64039578aa980bcfee7c42e2c7836d

SHA256
8c38d680acfe539aff81467aeed34e1b6bf9e418896cac9cefda3787e029d6a5

SHA512
59ff13f852e8ca1a9304f11ea10aff530b24f08b4e24d674fdd370bf6b66991a4af9007b382f11262c09a2cd0fdd8324963529fb4a97ce9b65c9c1fa47bd87d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
566B

MD5
381ac45cdf7aedc98e646056ccde4a8d

SHA1
168e192b23a595e9f41cf8d107d6c1d601c3ca77

SHA256
9f056538358e029a4a7f13bab71dec7dcec6a9ac69b95c766a887849faf49e84

SHA512
98ab242ae61cbeefe9816b68044a15f7118e2576c6e559fb1fb801cc405d4c81310183c6c6a31ab46791a1477d0f61ce113d98311f9858619e91a03935e8a4ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
63abed8c5b9e0136f858d3b5fd0933f3

SHA1
7d1729a4b5dfb42696a57aa4e7c1d92edb8bdf47

SHA256
3ad877e78cc57bff889be3911dea74b549f9eab52407710e4fab0e54028f47b2

SHA512
70b0147c938ecf379b5a4d517f4087caaaaa04dc13c9ca3900faac64443ee4769ae2316678a5f4b49f63dc670ce0dc3da08c79a77af127e3b3c9262c958dc219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b19bf1167f74d80ef6b01648fdb6874d

SHA1
381aa5480f1d54589be491d21d9e9e1fc8d2953e

SHA256
7ada7dd6f4b8e331de880db8687d67fc47a9ef138d4aef1e5c8bc8d78e8b5f49

SHA512
e9b09969d1ca25375289b93bbfd1a74acbde3dfdf2dcb2719e45074e41e50ce643aae86f84d9471e6c0784993cd7b0bbce894c9133a5554a054ad66a7f2a4a71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b3eab8e0018140d929477b2190009f5

SHA1
22a3ef2e383ff5c84743f634801e2d484510e9a3

SHA256
50cc0b7fe164cc3f7f7c252f6d5b1410e20f2bf07813690342c0da84b6f3b937

SHA512
7f48fa3d441729faa013f7e2d27718e07ecb933fd17352429c5458f468ae4e38183c80d68bf21a8f4bf485d09ba31c294d8f2b4d9227ba4abdfa04d79755ddb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2babd6c48369403ceb0e62762ef724be

SHA1
2e656183c7dee0ae8ae9b5eb361cd5884f694829

SHA256
6e45b5ab488834284f859c30331156076d2429fbbb1c7c6bb8a8f47cec0fd372

SHA512
f4bd88b94e4dc547811448df8edbd2851026b33916fc80c8b1558511aa381fe5663c371c8c41e03e2b3171cd5c96c3fa0324f8cf732dcb352cd697cc22864b87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4350790c5ce221003810409ebaf1ab5e

SHA1
5b6be3ea1e79b347d2d307ef6e74369cd224fcf2

SHA256
718d087bd1fdd3695ecbf02fbf119cd2f281a0e7ab03706b3fc5961d5250779b

SHA512
aa8011ac7260c485b7d170d5ee48251eb82e592fdeeff9fef4c90643a48c15a6a8caf7f2dd9c5b39e91bc730e1ab206538a94ec06a06dd87de6b96b6ce0a1ce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
05f4d857d9b3e4aa7ddcb73f461a7f7b

SHA1
ad6755eaae2e51bd52644dc58eec4ef0611191fd

SHA256
7b536316a4ecbb66655db2b073f8c97a7cdfacb5be205c8522136129c15e3764

SHA512
1d3de28d89f5b323a0f2fc0b7f7ef90b924bb0e18bc0965bb14b856419ca6d6221e42ef5560578b8fb38179bc940906c755ddad4b0ce09cc5b941fb14d5fce97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56ec39.TMP

Filesize
538B

MD5
517b778f79fd3f6fd041e1a55ca9cd0c

SHA1
3c7bfd6d73eb42488d3accccaa3ec5b7f4db6ac9

SHA256
55028bd6499be72e3a15ff300fd283fb967d97f105441d258e61f47fe71e4560

SHA512
b2d80e8a007c0b5730a6f4603883b64a8662801895b09015a776f265e1015180b8f80a5752edf29cd3d8a62b3297bf28e268c411250fdd5f8e03d42d838431cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
41e97f98d7e28fef0a0f9ad20e97a074

SHA1
65cf7d8990a1242226ea72d60fa3e5811f5defa4

SHA256
3be68bd76dedcab073fc604bbf38b49a55efd629c5490ea1f5b7ba4c6628d67c

SHA512
aee99f9b34de7081e00c3c1b3c01e80cd727a30d73d2d835a0ad21613f93503bc78fd6d64cea66d54fef525111e7c3f9ec53bbc314311f33767fff556e4be54b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
daa068fc75240b7059de38a9c5f4bd45

SHA1
82d9d6bcfbb7c801eaac8892223379cd479c3b68

SHA256
d293bad83452f2321e45f3ccba04c0573b9342fb5c8d0eac790a04492239a0e3

SHA512
be52d120d21e781875597f6b2027fa7245ec621356b80f4ea1967d4ce534a49dba3f5c61853c40e9cba53dd02757b4a02926db79d0be8d3dcf8065787cf4aa26

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
2f4106792308df86df2f827fcf87e956

SHA1
5104b6262e0b91b7cea7bc625f960004495da625

SHA256
eafcdf64186569de53e7545beda1875fafb240eca2ae9a1c7e186f88302b75b0

SHA512
ff69f9a94e61a6a89a6c7c1f24eeb44d944a896206590d3fdf373a8dabd47433cb7bcb38eef33cea0504336ba0412c1519ad60fdc70a65ae0b9c7dba2dd2a836

Download Submit